Re: ucspi-tls (attn: Scott Gifford)

On Thu, 12 May 2005 12:43:47 -0400
Scott Gifford <[email protected]> wrote:

> Good luck!  Let me know how things turn out.

Scott (and others), finally got around to doing some testing on this. 
I'm not an expert at TLS by any means, so I apologize upfront if any
of the problems I experienced are naive.

First off, a general question: is it possible to use the same
qmail-smtpd run file to enable SSL/TLS connections and straight up
SMTP connections (which is nice for local connections and webmail)? 
Right now I have to setup a seperate runfile to bind to port 465.  In
my previous mailfront/TLS implementation (using a patch posted on this
mailing list by Charlie Brady a while back) there was a TLSCOMMAND
variable that was consulted by mailfront which executed
smtpfront-qmail in a stunnel session if the STARTTLS command was sent.
 This allowed for SSL and non-SSL connections to work against the same
run file.  Unless I'm missing something this functionality seems to be
missing with the UCSPI-TLS patch?  

Secondly, I get a problem using the chroot feature:

@40000000429cb1ff0254179c sslserver: status: 1/31
@40000000429cb1ff02decf54 sslserver: warning: dropping connection,
unable to chroot
@40000000429cb1ff02e3b53c sslserver: end 2496 status 28416
@40000000429cb1ff02e49f9c sslserver: status: 0/31
@40000000429cb1ff02e67844 sslserver: pid 2497 from 64.83.223.150
@40000000429cb1ff030765f4 sslserver: ok 2497 0:192.168.0.3:465
:64.83.223.150::10992

<connection hangs here>

I verified that the UID and GID are correct in my runfile:

export SSL_CHROOT=1
export SSL_UID=6039
export SSL_GID=1011

These correspond to user/group smtpsd/smtpsd - I tried it with and
without a home directory.  Not sure what I did wrong...

Third, after disabling the chroot I was stilll unable to get a message
to go through via TLS:

@40000000429cb2ac31562274 sslserver: status: 1/31
@40000000429cb2ac31635174 sslserver: pid 2570 from 64.83.223.150
@40000000429cb2ac31684ae4 sslserver: ok 2570 0:192.168.0.3:465
:64.83.223.150::13763
@40000000429cb2c633588224 sslserver: warning: dropping connection,
unable to accept SSL: error:00000002:lib(0):func(0):system lib
@40000000429cb2c6335bba5c sslserver: end 2569 status 28416
@40000000429cb2c6335bcde4 sslserver: status: 0/31
@40000000429cb2c6335dd954 smtpfront-qmail[2570]: bytes in: 0 bytes
out: 23

This looks icky.  Anything I can do to debug?

Here is a copy of my qmail-smtpsd run file:

# more /service/qmail-smtpsd/run 
#!/bin/sh

# Script created from reading Life with qmail documentation

CONLIMIT=31

# enable UCSPI-TLS
export UCSPITLS=1
# enable this to force TLS
# export AUTH_REQUIRES_TLS=1
# run in chroot
#export SSL_CHROOT=1
#export SSL_UID=6039
#export SSL_GID=1011

# relay-ctrl expects tcpserver, to get around this,
# set env var and use perl script uspci-proto-hack
# http://multivac.cwru.edu./#quickies
# see /etc/relay-ctrl/NEWPROTO

exec /usr/local/bin/envdir /etc/mailfront/smtpfront \
    /usr/local/bin/softlimit -m 40000000 \
    /usr/local/bin/envdir /etc/relay-ctrl \
    /usr/local/bin/relay-ctrl-chdir \
    /usr/local/bin/sslserver -v -R -H -l 0  \
      -c ${CONLIMIT} \
      -x /etc/tcp.smtp.cdb \
      0 465 \
    /usr/local/bin/uspci-proto-hack \
    /usr/local/bin/relay-ctrl-check \
    /var/qmail/bin/mailrules.sh \

Thanks,

Josh